CVE-2026-122227

Name of the Vulnerable Software and Affected Versions Easy Property Listings versions prior to 3.5.29

Description An issue exists where authenticated attackers with contributor-level access and above can perform a generic SQL Injection. This occurs because the post type parameter is not sufficiently escaped and the SQL query is not properly prepared. Although the sanitize text field() function is used, it fails to escape single quotes, allowing an attacker to break out of the SQL IN('...') literal and append additional queries to extract sensitive information from the database.

Recommendations Update Easy Property Listings to version 3.5.29 or later. Avoid using the post type parameter in the affected plugin until the update is applied.